CVE-2017-9299

Open Ticket Request System (OTRS) 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=[XSS] and Direction=[XSS] attacks. NOTE: this CVE may have limited relevance because it represents a 2017 discovery of an issue in software from 2014. The 3.3.20 release, for example, is not affected.

• CWE-79

• http://code610.blogspot.com/2017/05/turnkey-feat-otrs.htmlExploit, Third Party Advisory
• http://code610.blogspot.com/2017/05/turnkey-feat-otrs.htmlExploit, Third Party Advisory

Published

May 29, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9292Lansweeper before 6.0.0.65 has XSS in an image retrieval URI…
• CVE-2017-9294RMI vulnerability in Hitachi Device Manager before 8.5.2-01 …
• CVE-2017-9295XXE vulnerability in Hitachi Device Manager before 8.5.2-01 …
• CVE-2017-9296Open Redirect vulnerability in Hitachi Device Manager before…
• CVE-2017-9297Open Redirect vulnerability in Hitachi Device Manager before…
• CVE-2017-9298Cross-site scripting vulnerability in Hitachi Device Manager…
• CVE-2017-9300plugins\codec\libflac_plugin.dll in VideoLAN VLC media playe…
• CVE-2017-9301plugins\audio_filter\libmpgatofixed32_plugin.dll in VideoLAN…
• CVE-2017-9302RealPlayer 16.0.2.32 allows remote attackers to cause a deni…
• CVE-2017-9303Laravel 5.4.x before 5.4.22 does not properly constrain the …
• CVE-2017-9304libyara/re.c in the regexp module in YARA 3.5.0 allows remot…
• CVE-2017-9305lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupwar…